OSDP Embedded
A portable, embedded-friendly implementation of OSDP
Secure, spec-compliant device communication for access control hardware, written in freestanding C11. No malloc. No globals. No OS dependencies in the core.
View on GitHub | Commercial Licensing Inquiries →
Does Your Device Need OSDP?
The Open Supervised Device Protocol (OSDP) is the SIA standard for communication between access control field devices (card readers, controllers, and peripherals) and the panels that manage them. If you’re building a PD, ACU, or bus monitor, you need an implementation small enough for constrained firmware and rigorous enough to pass real interop testing. That’s what OSDP Embedded is built for.
OSDP looks simple on paper, until you’re deep into Secure Channel key rotation, sequence-number edge cases, and the handful of ambiguities in the spec that only surface against real hardware in the field. Building that in-house means someone on your team owns it indefinitely: tracking spec revisions, re-testing interop every time a panel vendor ships a firmware update, and fixing the same class of framing bugs every other implementer has already hit. OSDP Embedded is maintained, tested, and supported so your team can spend that time on the product instead of the protocol.
OSDP Embedded implements SIA OSDP v2.2.2 and is structured so that a PD, an ACU, or a passive Monitor each pull in only the code they actually need. A PD-only firmware build doesn’t carry ACU logic. The linker garbage-collects everything you don’t reference.
The PD side is done and production-ready today, and has been validated against OSDP ACUs currently deployed in the field. ACU support is under active development and coming soon.
Why OSDP Embedded
- Freestanding C11 core. Portable across MCU toolchains and host platforms alike, with no dynamic allocation, no global state, and no assumptions about an underlying OS.
no_stdRust wrapper. An idiomatic, typed API (Pd,Acu,Transport,sc::ScCrypto) for teams building in Rust, with Cargo features to compile in only the PD or ACU role you need.- Opt-in Secure Channel support, with your own crypto. AES-128 encryption, key derivation, and CBC-MAC integrity are available when you need them, and the crypto and RNG code isn’t linked in at all when you don’t. The encryption backend is a separate, pluggable dependency: bind mbedTLS, hardware AES, a pure-software backend, or your platform’s existing crypto stack. The core never vendors a crypto implementation for you, so you’re never locked into ours.
- Built for interop, not just spec compliance. Verified byte-for-byte against SIA’s own
libosdp-conformancecapture suite, and validated live against Z-bit Systems’ own OSDP.Net, a mature, independent C# OSDP implementation used as a behavioral cross-check. - Message-direction architecture. The library is split by direction, not by role:
osdp::corefor framing and Secure Channel primitives,osdp::messagesfor per-command/reply codecs, andosdp::pdandosdp::acufor the respective state machines. Pull in what your device needs, and leave the rest out of the link. - Real tooling, not just a library. Command-line PD and ACU mocks for live serial-port interop testing, an OSDP capture-file parser/analyzer, and an MCP server that lets AI coding agents drive a virtual PD for automated interop testing and regression-test generation.
Architecture at a Glance
| Target | Contents | Used by |
|---|---|---|
osdp::core | CRC-16, checksum, frame decode/build, and Secure Channel primitives (key derivation, cryptograms, CBC-MAC, AES-CBC payload encrypt/decrypt) | Everything |
osdp::messages | One translation unit per command and per reply, each containing a model, decoder, and builder | PD, ACU, Monitor |
osdp::dispatch | Optional switch-router from raw frame to typed message | Monitor only |
osdp::pd | PD-side state machine covering address filtering, command dispatch, sequence-number policing, and Secure Channel handshake | PD applications |
osdp::acu | ACU-side state machine covering multi-PD management, command issuance, timeout/reply callbacks, and Secure Channel handshake | ACU applications |
Coverage today includes framing for every OSDP frame variant, 20 of 25 Annex A commands and 19 of 21 replies (the full v2.2 set outside the credential-domain families), and the complete Secure Channel handshake and operational message set.
License
Like other serious embedded infrastructure libraries, OSDP Embedded is dual-licensed so you can choose the terms that fit your product:
Open Source (GPL-3.0-or-later)
Free to use if your product is also distributed under a GPL-compatible license. The GPL license is also free to use for evaluation, proof-of-concept work, and internal testing: build against it, benchmark it, and confirm it’s a fit before you commit to a commercial agreement. Every source file carries the GPL-3.0-or-later SPDX identifier.
Commercial License
For proprietary and closed-source embedded firmware that can’t comply with GPL terms. Commercial licensees receive a separate written agreement that supersedes the GPL terms for their use, along with direct access to Z-bit Systems for support and integration guidance.
| License fee | $2,750 per product family, one-time |
| Scope | Unlimited units, unlimited SKUs, perpetual |
| Included support | 3 years of support included with every license |
| Support renewal | $550/year after the included period |
One fee, one product family, royalty-free. No per-unit fees, no unit reporting, no audits. A product family is every model, SKU, form factor, faceplate, finish, and enclosure variant built from a common firmware code base on a single processor platform. Reader manufacturers typically ship dozens of SKUs — different sizes, mounting styles, faceplates, and finishes — off one firmware image. That’s one license, not dozens. A new family (and a new license) begins when the firmware moves to a different processor architecture or a new-generation code base.Products sold under another company’s brand require that company to hold its own license at the standard fee. Contact us if you’re structuring an OEM or private-label arrangement.
Support includes:
- Direct access to the Z-bit Systems engineering team for break-fix and integration questions
- Bug fixes and security patches for the duration of your support term
- Guidance applying updates as ACU support and new protocol features land
Contact Z-bit Systems about commercial licensing →
Get Started
cmake --workflow --preset debugCMake-based, targeting Windows (MSVC/Clang/MinGW) and any embedded toolchain with a C11 compiler. The Rust crate (osdp-embedded on crates.io) wraps the C library behind a no_std-compatible API and compiles the C sources directly via the cc crate, so no separate CMake step is required.
Built by the same team behind OSDP.Net and OSDP Bench. Z-bit Systems has been building OSDP tooling and access-control software for years, and OSDP Embedded is the freestanding C/Rust counterpart to that work.
If you’re building a PD, ACU, or bus monitor, you need an implementation small enough for constrained firmware and rigorous enough to pass real interop testing. That’s what OSDP Embedded is built for.